Skip to content

chore(CI): Konflux build to UBI9 #2815

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
davdhacs wants to merge 23 commits into
base: master
Choose a base branch
from
+10,926 −12,329
Open

chore(CI): Konflux build to UBI9 #2815

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
6897630
Migrate Konflux build to UBI9/RHEL9 base images
davdhacs Jan 23, 2026
23cacca
Add hermetic RPM prefetch for RHEL9 packages
davdhacs Jan 23, 2026
3f88be9
remove duplicated cachi2 env sourcing
davdhacs Jan 23, 2026
2cbf118
Use bare: true context for RPM lockfile generation
davdhacs Jan 23, 2026
7f0efb4
Regenerate rpms.rhel.repo and rpms.lock.yaml with source RPMs enabled
davdhacs Jan 24, 2026
a9a6866
remove 9 from repo suffix
davdhacs Jan 24, 2026
094e8aa
Merge master (keep UBI9 rpms)
davdhacs Jan 25, 2026
bc767da
Fix rpms.rhel.repo to use $basearch variable in name fields
davdhacs Jan 26, 2026
e01bd2b
Merge branch 'master' into konflux-ubi9-migration
davdhacs Jan 26, 2026
6dcdf3d
empty commit
davdhacs Jan 26, 2026
ae9872f
restore "-rhel9" image suffix
davdhacs Jan 26, 2026
b646a09
Add elfutils-libelf runtime dependency to UBI9 image
davdhacs Jan 27, 2026
2ca1e46
Remove unnecessary enabled_metadata=1 from source repos
davdhacs Jan 27, 2026
8cb31c2
remove trailing newline
davdhacs Jan 27, 2026
7803a02
Merge branch 'master' into konflux-ubi9-migration
davdhacs Jan 29, 2026
fc62411
Merge branch 'master' into konflux-ubi9-migration
davdhacs Feb 1, 2026
1293806
Merge branch 'master' into konflux-ubi9-migration
davdhacs Feb 2, 2026
c19ef4f
Merge branch 'master' into konflux-ubi9-migration
davdhacs Feb 3, 2026
aa3f14b
un-pin clang version
davdhacs Feb 3, 2026
cabcba4
Merge branch 'master' into konflux-ubi9-migration
davdhacs Feb 5, 2026
ef9657c
Merge branch 'master' into konflux-ubi9-migration
davdhacs Feb 6, 2026
1de8739
Merge branch 'master' into konflux-ubi9-migration
davdhacs Feb 12, 2026
428797b
Merge branch 'master' into konflux-ubi9-migration
davdhacs Feb 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .tekton/collector-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ spec:
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el8"
- "cpe=cpe:/a:redhat:advanced_cluster_security:X.Y::el9"

workspaces:
- name: git-auth
Expand Down
9 changes: 5 additions & 4 deletions collector/container/konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ ARG BUILD_DIR=/build
ARG CMAKE_BUILD_DIR=${BUILD_DIR}/cmake-build


FROM registry.access.redhat.com/ubi8/ubi:latest@sha256:a2874895561a0f52e84c78c9c8b504922cd0dd03dc19d682a51c935d29330c55 AS builder
FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:22e95731596d661ff08daabaa5ef751b20ac42d0a58492dac5efa7373f471389 AS builder

RUN dnf -y install --nobest --allowerasing \
make \
Expand Down Expand Up @@ -79,11 +79,12 @@ RUN ctest --no-tests=error -V --test-dir "${CMAKE_BUILD_DIR}"
RUN strip -v --strip-unneeded "${CMAKE_BUILD_DIR}/collector/collector"


FROM registry.access.redhat.com/ubi8/ubi-minimal:latest@sha256:de46044c1c8d595193316655c441f196cf885bda9fb97244679b458327c19142
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:90bd85dcd061d1ad6dbda70a867c41958c04a86462d05c631f8205e8870f28f8

RUN microdnf -y install --nobest \
tbb \
c-ares && \
c-ares \
elfutils-libelf && \
microdnf -y clean all && \
rpm --verbose -e --nodeps $(rpm -qa 'curl' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*' 'libyaml*' 'libarchive*') && \
rm -rf /var/cache/dnf /var/cache/yum
Expand All @@ -101,7 +102,7 @@ LABEL \
io.k8s.display-name="collector" \
io.openshift.tags="rhacs,collector,stackrox" \
maintainer="Red Hat, Inc." \
name="advanced-cluster-security/rhacs-collector-rhel8" \
name="advanced-cluster-security/rhacs-collector-rhel9" \
# Custom Snapshot creation in `operator-bundle-pipeline` depends on source-location label to be set correctly.
source-location="https://github.com/stackrox/collector" \
summary="Runtime data collection for Red Hat Advanced Cluster Security for Kubernetes" \
Expand Down
3 changes: 2 additions & 1 deletion rpms.in.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ packages:
- make
- wget
- unzip
- clang-19.1.7
- clang
Copy link
Contributor

@JoukoVirtanen JoukoVirtanen Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure about unpinning this.

Copy link
Author

@davdhacs davdhacs Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

UBI9 has clang-20.1.8 but we un-pinned (and it resolved to 20.1.8 without the pin, for now) #2815 (comment)

It went through the smoke test without problems, but I assume there was a reason to pin it in the first place.

- llvm
- cmake
- gcc-c++
Expand All @@ -26,6 +26,7 @@ packages:
# final stage in collector/container/konflux.Dockerfile
- tbb
- c-ares
- elfutils-libelf
Copy link
Author

@davdhacs davdhacs Jan 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ovalenti It looks like this is needed now. Is this valid?

Copy link
Author

@davdhacs davdhacs Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

$ docker run --rm registry.access.redhat.com/ubi8/ubi-minimal:latest rpm -q elfutils-libelf
elfutils-libelf-0.190-2.el8.aarch64
$ docker run --rm registry.access.redhat.com/ubi9/ubi-minimal:latest rpm -q elfutils-libelf
package elfutils-libelf is not installed

Copy link
Contributor

@ovalenti ovalenti Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, especially since it is installed in the konflux docker file. This is one of the few runtime dependencies of collector.

contentOrigin:
repofiles: [ "rpms.rhel.repo" ]
context:
Expand Down
Loading
Loading